Vllm

CVEs (88)

• CVE-2026-93592HigSep 18, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.00

  vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side…

• CVE-2026-93436HigSep 17, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.

• CVE-2026-37237HigAug 28, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without…

• CVE-2026-55574HigJul 6, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the…

• CVE-2026-54234HigJul 6, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value,…

• CVE-2026-53923HigJun 22, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.00

  vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is…

• CVE-2026-41523HigJun 22, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious…

• CVE-2026-5497HigJun 11, 2026
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to…

• CVE-2025-59425HigOct 7, 2025
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more…

• CVE-2025-48956HigAug 21, 2025
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server…

• CVE-2025-30202HigApr 30, 2025
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ…

• CVE-2025-24357HigJan 27, 2025
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When…

• CVE-2024-8768HigSep 17, 2024
  Vllm

  Vllm
  risk 0.42cvss 7.5epss 0.01

  A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.

• CVE-2024-8939MedSep 17, 2024
  Vllm

  Vllm
  risk 0.40cvss 6.2epss 0.00

  A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a best_of parameter to return the best…

• CVE-2026-25960HigMar 9, 2026
  Vllm

  Vllm
  risk 0.39cvss 7.1epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.…

• CVE-2026-24779HigJan 27, 2026
  Vllm

  Vllm
  risk 0.39cvss 7.1epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async…

• CVE-2025-66448HigDec 1, 2025
  Vllm

  Vllm
  risk 0.39cvss 7.1epss 0.01

  vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves…

• CVE-2025-6242HigOct 7, 2025
  Vllm

  Vllm
  risk 0.39cvss 7.1epss 0.00

  A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target…

• CVE-2025-9141higAug 21, 2025
  Vllm

  Vllm
  risk 0.39cvss —epss 0.04

  ### Summary An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call. ### Details vLLM's [Qwen3 Coder tool…

• CVE-2026-69147MedSep 16, 2026
  Vllm

  Vllm
  risk 0.35cvss 6.5epss 0.00

  vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that choice to VideoMediaIO even when…